{{ __('Manage roles, assign permissions, and control access levels within the system.') }}

@can('manage access rights') @endcan

@can('manage access rights') @endcan @can('manage access rights') @endcan {{-- filter bar --}} @can('manage access rights') @endcan

	{{ __('Status') }}	{{ __('Role Name') }}	{{ __('Guard') }}	{{ __('Assigned Permissions') }}	{{ __('Created At') }}	{{ __('Created By') }}	{{ __('Last Updated At') }}	{{ __('Last Updated By') }}	{{ __('Action') }}

@csrf {{-- anti autofill trap --}}

{{ __('Role Name') }} *

{{ __('Guard Name') }} *

{{ __('Permissions assigned here will grant access to specific features.') }}

{{ __('Assign Permissions') }} @include('pages.access_control.partials.permission_dual_panel', [ 'panelId' => 'add', 'rolePermIds' => [], ])

@csrf @method('PUT')

{{-- ==================================================================== RBAC DOCUMENTATION (MODAL) ==================================================================== --}}

The mental model

USER

A person who logs in

ROLE

A named bundle (e.g. Admin)

PERMISSION

One specific action

A user is given one or more roles. Each role contains a set of permissions. A user can do an action if any of their roles grants the matching permission.

Core concepts

@php $concepts = [ ['icon'=>'bi-people-fill','color'=>'#f59e0b','title'=>'Role','desc'=>'A named container — e.g. Super Admin, Manager, Staff. Roles are human-readable groupings meant to mirror real positions in your organisation.'], ['icon'=>'bi-key-fill','color'=>'#22c55e','title'=>'Permission','desc'=>'A single capability — e.g. view dashboard, manage users. Always phrased as verb + object (view / manage / create / delete + noun).'], ['icon'=>'bi-shield-fill','color'=>'#3b82f6','title'=>'Guard','desc'=>'The authentication context. web = browser session (this UI). api = token-based mobile/API clients. A role / permission belongs to exactly one guard.'], ['icon'=>'bi-archive-fill','color'=>'#94a3b8','title'=>'Archive','desc'=>'Soft-delete. Archived roles disappear from assignment dropdowns but their history is preserved. Users still holding an archived role lose its permissions until restored.'], ]; @endphp @foreach($concepts as $c)

{!! $c['desc'] !!}

@endforeach

`view` vs `manage` · the most important convention

view <module>

Lets the user open the page and read data. Read-only.

Examples: view dashboard, view health and logs, view action history

manage <module>

Lets the user create, edit, delete within that module. Implies view.

Examples: manage users, manage access rights, manage backup and storage

Rule of thumb: grant view liberally, grant manage sparingly. For modules a role doesn't touch at all, don't assign either — keeps the audit log clean.

Day-to-day workflow

@php $flows = [ ['icon'=>'bi-plus-circle','color'=>'#22c55e','title'=>'Create a role','desc'=>'Click + Add Role. Give it a name (e.g. Finance Manager), pick a guard (usually web), and tick the permissions it should grant.'], ['icon'=>'bi-person-plus','color'=>'#3b82f6','title'=>'Assign to user','desc'=>'Go to User Directory → edit a user → assign one or more roles. Changes take effect immediately on next request.'], ['icon'=>'bi-sliders','color'=>'#8b5cf6','title'=>'Tune permissions','desc'=>'Edit the role to add/remove permissions. Every user holding that role inherits the change instantly — no need to touch each user.'], ['icon'=>'bi-archive','color'=>'#f59e0b','title'=>'Archive (soft-delete)','desc'=>'Archive removes the role from assignment dropdowns but keeps history. Use this when phasing out a position. Users keep working but lose the permissions.'], ['icon'=>'bi-arrow-counterclockwise','color'=>'#06b6d4','title'=>'Restore','desc'=>'Filter to Arsip, find the role, click restore. Users who used to hold it regain their permissions.'], ['icon'=>'bi-x-circle','color'=>'#ef4444','title'=>'Hapus Permanen','desc'=>'Only available in the archive view. Irreversible. Removes the role record and unassigns every user. Use with caution.'], ]; @endphp @foreach($flows as $f)

{!! $f['desc'] !!}

@endforeach

DON'T LOCK YOURSELF OUT

Always keep at least one active user with the manage access rights permission. If you accidentally remove this permission from every active role, no one can log in and fix it through the UI — recovery requires direct database edit or a CLI artisan command.

Tip: create a dedicated Super Admin role with every permission and assign it to at least two trusted accounts. Never archive it.

Recommended role patterns

ROLE	WHO	TYPICAL PERMISSIONS
Super Admin	Owner / lead developer	All permissions
Admin	Operations lead, head of IT	Everything except `manage backup and storage`, `manage maintenance mode`
Manager	Department / team lead	`view *` + `manage users` (for their team), no infra permissions
Staff	End user / operator	`view dashboard`, module-specific viewers, nothing destructive
Auditor	Compliance / external audit	`view *` only — including `view action history`

Troubleshooting

SYMPTOM	LIKELY CAUSE	FIX
User gets 403 on a menu they should see	Missing matching `view <module>` permission	Edit role → tick the relevant `view` permission
User sees menu but action button missing	Has `view` but not `manage`	Edit role → add the `manage` counterpart
Permission change not taking effect	Permission cache stale	Run `php artisan permission:cache-reset` or re-login
User has role but still blocked	User itself is inactive / archived	User Directory → restore / activate the user
"You don't have permission" everywhere	All roles got `manage access rights` stripped	CLI rescue: `php artisan permission:grant {user} "manage access rights"`
Two users with same role behave differently	One has additional roles attached	Permissions are union across roles — check both users' role lists

Best practices

@php $tips = [ ['icon'=>'bi-1-circle-fill','title'=>'Least privilege','desc'=>'Start each new role with nothing ticked, then add only what is truly needed. Easier than starting from "everything" and trying to remember what to remove.'], ['icon'=>'bi-2-circle-fill','title'=>'One role per real-world position','desc'=>'Mirror your org chart. Finance Manager, Warehouse Staff — not Role A, Custom 1. Future-you will thank you.'], ['icon'=>'bi-3-circle-fill','title'=>'Keep Super Admin small','desc'=>'Only 1–2 people should have full manage access rights. Everyone else gets scoped roles.'], ['icon'=>'bi-4-circle-fill','title'=>'Audit periodically','desc'=>'Every quarter, open this page → scroll the role list → ask "does each role still match how the team works?" Archive stale ones.'], ['icon'=>'bi-5-circle-fill','title'=>'Don\'t reuse a guard','desc'=>'A role with web guard cannot be assigned to API users and vice versa. Decide before creating.'], ['icon'=>'bi-6-circle-fill','title'=>'Document non-obvious permissions','desc'=>'If a permission name doesn\'t make its scope obvious, write a short note in the description field when adding it.'], ]; @endphp @foreach($tips as $tip)

{!! $tip['desc'] !!}

@endforeach

Implementation note

This system uses Spatie Laravel Permission. Roles and permissions are stored in the roles, permissions, role_has_permissions, and model_has_roles tables. Permission checks happen on every request via @@can('...') in Blade and $user->can('...') in controllers / middleware.

{{ __('Roles Management') }}

{{ __('Add Role') }}

{{ __('Update Role') }}